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Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )Q Responsive to communication(s) filed on . 

2a)^ This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quay/e, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) E>3 Claim(s) 1-13 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) £3 Claim(s) 1-13 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)Q objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .0 Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



Claim Rejections - 35 USC § 102 



1. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

2. Claims 1-13 are rejected under 35 U.S.C. 102(b) as being anticipated by Ji et 
al.(5,623,600). 

3. As per claim 1, Ji discloses intercepting and processing code on a communications 
channel(see col. 2, lines 39-42, 54-64); a protocol parser(see col. 5, lines 39-66). The Examiner 
asserts that the Applicant does not define a protocol parser, for the purpose of applying art the 
protocol parser is the proxy server in Ji. Ji et al. discloses a protocol parser because the proxy 
server is in between the application layer and the transport layer and examines packets 
transmitted, and intercepts then to determine if they contain viruses(see fig. 4, sheet 4, col. 5, 
lines 39-67, col. 6, lines 1-11). The Examiner asserts that the proscribed code scanner is the 
virus scanner of Ji(see col. 7, lines 59-65). The virus scanner intercepts files and examines the 
files by checking the extension of file names(see col. 7, lines 33-40); whereby the protocol parser 
intercepts the code traveling on the channel and transmits the code for review by the proscribed 
code scanner(see col. 7, lines 29-65). 

4. As per claim 2, Ji et al. discloses whereby the protocol parser transmits the code to the 
proscribed code scanner through the protocol scanner(see col.7, lines 29-65). 
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5. As per claim 3, Ji et al. discloses whereby the proscribed code scanner further includes, a 
scanning means an indicator means, whereby the indicator means provides an indication of the 
presence of proscribed code after scanning the intercepted code(see col.l 1, lines 57-67, col. 12, 
lines 1-40). 

6. As per claim 4, Ji et al. discloses whereby the proscribed code scanner includes a virus 
scanner(see col. 7, lines 58-67, col. 11, lines 1). 

7. As per claim 5, Ji et al. discloses wherein the protocol parser further includes a 
configuration means for configuring interception parameters(see col. 9, lines 1-27). 

8. As per claim 6, Ji et al discloses wherein the protocol scanner includes a configuration 
means for configuring interception parameters(see col. 7, lines 51-67). 

9. As per claim 7, Ji et al. discloses a protocol parser(see col. 5, lines 39-66); a protocol 
scanner(see col. 7, lines 29-65); and a proscribed code scanner includes a scanning means and 
indicator means; whereby the protocol parser transmits the code to the proscribed code scanner 
through the protocol scanner, and whereby the indicator means provides an indication of the 
presence of proscribed code after scanning the intercepted code(see col. 11, lines 57-67, col. 12, 
lines 1-40). 

10. As per claim 8, Ji et al. discloses intercepting the code; parsing the code; scanning the 
code for the presence of proscribed code(see col. 7, lines 29-67); and providing an indicator for 
the presence of the proscribed code(see col. 1 1, lines 57-67, col. 12, lines 1-40). 

11. As per claim 9, Ji et al. discloses returning the code to the communication channel if the 
indicator is negative(see col. 7, lines 29-46). 
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12. As per claim 10, Ji et al. discloses further indicating the presence of the proscribed code 
if the indicator is positive(see col. 7, lines 50-67). 

13. As per claim 1 1, Ji et al. discloses wherein the step of intercepting the code further 
includes intercepting the code according to configured parameters(see col. 8, lines 6-34). 

14. As per claim 13, Ji et al. discloses wherein the step of scanning the code for the presence 
of proscribed code includes scanning the code for the presences of viruses(see col. 7, lines 29- 
67). 

Claim Rejections - 35 USC § 103 

15. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

16. Claim 12 is rejected under 35 U.S.C. 103(a) as being unpatentable over Ji et 
al.(5,623,600). 

17. As per claim 12, Ji et al. discloses the step of providing a separate system inserted in the 
communications channel(see col. 2, lines 54-67, and with at least one of the steps of intercepting 
the code; scanning the code for the presence of proscribed code(see col. 7, lines 50-67), and 
providing an indicator for the presence of the proscribed code, occurring on the separate 
machine(see col. 3, lines 4-16). However, Ji et al. does not disclose decrypting code. 

18. The Examiner takes Official Notice that it is well-known in the art to have 
encryption/decryption, the motivation is that encrypting and decryption code, insures that only 
the intended recipient can view the code. 
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Response to Amendment 



19. The Applicant states that Ji(5 ,623,600) does not disclose a protocol parser because Ji only 
operates on two predetermined protocols, FTP and SMTP. The Examiner disagrees, Ji does 
disclose a protocol parser because Ji's proxy server is in between the application and transport 
layer and intercepts and examines the packets on the network(see col. 5, lines 39-67, col. 6, lines 
1-11). The Examiner agrees with the Applicant that Ji does disclose the protocols, examining the 
packets with the protocols of FTP and SMTP. However, the claim language is to be interpreted 
broadly by the Examiner. Therefore, the claim limitations do not claim specific protocols. 
Therefore, this point is moot. 

20. The Applicant has provided references to other prior art that contains a protocol parser. 
Again, Ji discloses a protocol parser as discussed above and also prior rejection. The Examiner 
has reviewed prior art, and if the Applicant wishes to add additional features to the claim 
limitations than the Applicant is urged to do so. The Applicant references many time throughout 
response that the protocol parser is limited in the protocols it parsers. Again, Ji meets the claim 
limitation, which discloses a protocol parser. 

21. The Applicant states that Ji's proxy servers do not examine and intercept packets. The 
Examiner disagrees with the Applicant. Ji discloses examine and intercepting packets to see if 
they contain viruses(see col. 3, lines 4-16). Further, Ji discloses that the transfer of data between 
networks is broken down into the sending and receiving files and messages which in turn are 
broken down into packets(see col. 4, lines 49-55). 

22. The Applicant states that the Examiner is using a protocol parser and scanner to describe 
the same element. The Examiner disagrees. Ji does discloses that the proxy server(i.e. protocol 
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parser) determines whether the file to be transferred is of a type that can contain a virus, if it is of 
a type to contain a virus, it is transferred to a gateway node, where a virus scanning is 
performed(see col. 7, lines 33-65). Ji discloses that a virus checking program is stored at the 
gateway node, and the virus detection is a program, and thus Ji discloses a scanner(see col. 56- 
66). 

23. The Applicant states that Ji does not disclose configuring means for configuring 
interception parameters. The Examiner disagrees with the Applicant. Ji discloses configuring 
means for configuring interception parameters, because Ji discloses a protocol parser that is a 
that parsers protocols FTP and SMTP, thus the ports are configured to handle these protocols(see 
col. 7, lines 6-28). 

24. Ji discloses parsing the code via protocol parser, because Ji discloses that the code is 
parsed for to check for file extensions that may contain a virus(see col. 7, lines 29-40). 



Final Action 

25. THIS ACTION IS MADE FINAL, Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
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however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jenise E Jackson whose telephone number is (703) 306-0426. 
The examiner can normally be reached on M-Th (6:00 a.m. - 3:30 p.m.) alternate Friday's. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (703) 305-9648. The fax phone numbers for the 
organization where this application or proceeding is assigned are (703) 305-0040 for regular 
communications and (703) 308-6306 for After Final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703) 305-3900. 



Conclusion 




May 25, 2004 
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